Your Go-To Resource

DMARC | DKIM | SPF Check

Why Your Emails Might Be Getting Blocked (and How We Fixed a Real Client’s Problem)

A few weeks ago, one of our clients got a call from a major customer who said, “We haven’t heard from you in weeks — did something happen?”

The reality? Our client had been sending emails as usual, but none of them were getting through. He had been ignoring those little “undeliverable” messages in his inbox — until the day it started to cost him a valuable business relationship.

When he called Maryland Web Design, we asked him to forward one of those bounce-back emails. The error revealed that while his DMARC policy was technically set up, Google had gotten more restrictive and wanted a more specific policy — not just a generic one.

We logged into his DNS, made the correct DMARC adjustments so it passed the authentication tests on MXToolbox SuperTool… but there was still a problem.

A deeper look showed that his DMARC, SPF, and DKIM weren’t fully aligned. So we pulled the correct CNAME records from his Microsoft 365 account, updated his DNS records properly, and voilà — his emails started going through immediately. His major client got the message, and business resumed as usual.

👉 If your email deliverability is acting up, don’t ignore those undeliverable messages. The fix might be simpler than you think.

Get Started
Facebook Twitter Instagram Youtube

Why Email Authentication Matters More Now Than Ever

Both Google and Yahoo have rolled out new email sender authentication requirements as of February 1, 2024, aimed at reducing spam and phishing and improving overall deliverability.

If you send email marketing campaigns or rely on email communication for business, you must comply with these new standards to avoid getting blocked.

What Changed: Google & Yahoo’s New Sender Requirements

  1. Authentication Is Mandatory
    Email marketers must prove they’re legitimate senders using SPF, DKIM, and DMARC. If you own your domain, you’ll need to set up proper records to meet the requirements.

  2. Simple One-Click Unsubscribe
    Bulk senders must support one-click unsubscribe in email headers. (We already do this at Maryland Web Design — ✅ covered.)

  3. Keep Spam Complaints Low
    If you’re collecting email opt-ins correctly, this won’t be an issue. We also monitor accounts for spam complaints and take action when needed.

📝 Important Date: These rules went into effect February 1, 2024. If your emails suddenly start bouncing or not being returned, this could be why.

website-email-security

SPF — Sender Policy Framework

SPF authorizes which mail servers are allowed to send email on behalf of your domain.

Where to set it up:

  • Log into your DNS provider (e.g., SiteGround).

  • Add or update a TXT record for your domain.

Example SPF record:

v=spf1 include:spf.protection.outlook.com -all

MX Lookup:

  • Use MXToolbox SPF Lookup

  • Or run:

nslookup -type=TXT yourdomain.com

✅ Make sure all authorized mail services (e.g., Microsoft 365, SendGrid, Mailchimp) are listed in your SPF record.

DMARC-DKIM-SPF

DKIM — DomainKeys Identified Mail

DKIM provides a cryptographic signature that proves an email was not tampered with during delivery.

Where to configure it for Microsoft 365:

  1. Go to https://security.microsoft.com

  2. Navigate to: Email & Collaboration → Policies & Rules → DKIM

  3. Select your domain

  4. Copy the two provided CNAME records:

    selector1._domainkey.yourdomain.com
selector2._domainkey.yourdomain.com

  5. Add them to your DNS records.

  6. Wait for propagation, then click Enable DKIM in Microsoft.

MX Lookup:

nslookup -type=CNAME selector1._domainkey.yourdomain.com
DMARC-DKIM-SPF-check-2

DMARC — Domain-based Message Authentication, Reporting & Conformance

DMARC tells receiving mail servers what to do when SPF or DKIM checks fail. It’s the final enforcement layer.

Where to configure it:

  • Log into your DNS provider.

  • Add a TXT record for:

    _dmarc.yourdomain.com

  • Example DMARC policy:

    v=DMARC1; p=quarantine; rua=mailto:you@yourdomain.com; fo=1; aspf=s; adkim=s

    For stricter enforcement:

    v=DMARC1; p=reject; rua=mailto:you@yourdomain.com; fo=1; aspf=s; adkim=s

MX Lookup:

nslookup -type=TXT _dmarc.yourdomain.com
DMARC-DKIM-SPF

DKIM — DomainKeys Identified Mail

How SPF, DKIM, and DMARC work together 

  • SPF approves the servers that can send as you.

  • DKIM signs each message so receivers trust the content.

  • DMARC enforces policy and blocks bad actors while sending you intel.

Therefore, when all three align, inbox placement improves and spoofing attempts fail.

Pro tips to stay compliant

  • Regularly retest SPF, DKIM, and DMARC after vendor or DNS changes.

  • Keep your From domain consistent across tools.

  • Add the required list-unsubscribe header.

  • Reduce complaints with clear subject lines and a visible unsubscribe.

  • Finally, review DMARC reports monthly and prune unknown senders.

Why this matters for your business

When authentication fails, mail gets rejected, lands in spam, or silently disappears. However, once you align SPF, DKIM, and DMARC, sales teams see replies again, invoices arrive, and support tickets stop getting lost. In short, strong authentication protects your brand and your pipeline.

Need help today?

We audit your DNS, configure SPF/DKIM/DMARC, and verify deliverability—often the same day. Call 410-404-0663 or request a quick check.
Click Here

Subscribe to our newsletter

A free newsletter on digital marketing, AI, web design, SEO, social media, hosting and information on trends, resources and tips on how to maximize your online business.